System and method for performing a snapshot and for restoring data

A method in a computing system for tracking snapshots taken of a volume of data, wherein a snapshot is a point-in-time representation of the volume of data, the method comprising:

• creating a first snapshot stored in a memory of a computer of the volume of data, wherein the first snapshot includes information identifying data objects within the volume of data at a first time and information identifying a location of the identified data objects at the first time;
• mapping the data objects within the volume of data to the first snapshot, wherein the mapping includes updating a first data structure that contains entries associating data objects with corresponding portions of the first snapshot that include the information identifying the location of the identified data objects at the first time;
• creating a second snapshot stored in a memory of a computer of the volume of data, wherein the second snapshot includes information identifying data objects within the volume of data at a second time after the first time and information identifying a location of the identified data objects at the second time;
• comparing the first snapshot with the second snapshot to determine data objects that changed after the first time;
• mapping the changed data objects to the second snapshot, wherein the mapping the changed data objects includes updating a second data structure that includes entries associating the changed data objects with corresponding portions of the second snapshot that include the information identifying the location of the changed data objects at the second time;
• copying the changed data objects and the second snapshot of the volume of data to a location remote from the volume of data;
• wherein mapping the data objects within the volume of data to the snapshots includes mapping individual files or folders within the volume of data to corresponding portions of the snapshots.